This is an automated email from the ASF dual-hosted git repository. dashorst pushed a commit to branch wicket-8.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit 71b4db75d0098a996098403b2232529c12e56b6d Author: Pedro Santos <[email protected]> AuthorDate: Sat Oct 3 12:59:24 2026 -0300 Escape the css class the filter form writes into its hidden fields FilterForm builds the markup of its hidden fields with String.format, and escapes three of the four values it substitutes: the css id twice and the submitted value. The fourth, the css class it reads from the resource bundles, went in as it stands, so a quote in it ended the attribute it was written into and the rest of it was read as further attributes of the div. It now goes through Strings#escapeMarkup like the others. A value the framework writes into markup is escaped by the code that writes it, whichever of them the value came from. Co-Authored-By: Claude Fable 5 <[email protected]> --- .../repeater/data/table/filter/FilterForm.java | 2 +- .../repeater/data/table/filter/FilterFormTest.java | 38 ++++++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/wicket-extensions/src/main/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterForm.java b/wicket-extensions/src/main/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterForm.java index a5caa3895a..8f07f1ec5d 100644 --- a/wicket-extensions/src/main/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterForm.java +++ b/wicket-extensions/src/main/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterForm.java @@ -93,7 +93,7 @@ public class FilterForm<T> extends Form<T> getResponse().write( String.format( "<div style='position: absolute; left: -9999px; width: 1px; height: 1px;' class='%s'><input type='hidden' name='%s' id='%s' value='%s'/><input type='submit'/></div>", - cssClass, id, id, Strings.escapeMarkup(value))); + Strings.escapeMarkup(cssClass), id, id, Strings.escapeMarkup(value))); } /** diff --git a/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterFormTest.java b/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterFormTest.java index 4dd17721f8..a386cf5c54 100644 --- a/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterFormTest.java +++ b/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/repeater/data/table/filter/FilterFormTest.java @@ -16,6 +16,14 @@ */ package org.apache.wicket.extensions.markup.html.repeater.data.table.filter; +import static org.junit.Assert.assertTrue; + +import java.util.Locale; + +import org.apache.wicket.Component; +import org.apache.wicket.core.util.string.CssUtils; +import org.apache.wicket.markup.html.form.Form; +import org.apache.wicket.resource.loader.IStringResourceLoader; import org.apache.wicket.util.tester.WicketTestCase; import org.junit.Test; @@ -26,4 +34,34 @@ public class FilterFormTest extends WicketTestCase public void test() throws Exception { executeTest(FilterFormTestPage.class, "FilterFormTestPage_expected.html"); } + + /** + * The css class from the resource bundle is written into the markup of the hidden fields. + */ + @Test + public void cssClassIsEscapedAsMarkup() + { + tester.getApplication().getResourceSettings().getStringResourceLoaders().add(0, + new IStringResourceLoader() + { + @Override + public String loadStringResource(Class<?> clazz, String key, Locale locale, + String style, String variation) + { + return CssUtils.key(Form.class, "hidden-fields").equals(key) ? "a'b" : null; + } + + @Override + public String loadStringResource(Component component, String key, Locale locale, + String style, String variation) + { + return loadStringResource((Class<?>)null, key, locale, style, variation); + } + }); + + tester.startPage(FilterFormTestPage.class); + + String response = tester.getLastResponseAsString(); + assertTrue(response, response.contains("class='a'b'")); + } }
